Information Commissioner’s Office 


Consultation: Age appropriate design code 


Introduction 


The Information Commissioner is seeking feedback on her draft code of practice Age appropriate 
design: a code of practice for online services likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the Commissioner will expect 
providers of online ‘Information Society Services’ (ISS), which process personal data and are likely 
to be accessed by children, to meet. 


The code is now out for public consultation and will remain open until 31 May 2019. The 
Information Commissioner welcomes feedback on the specific questions set out below. 


For this consultation, we will publish all resoonses except for those where the respondent indicates 
that they are an individual acting in a private capacity (e.g. a member of the public or a parent). All 
responses from organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, education professionals) will be 
published. We will remove email addresses and telephone numbers from these responses but 
apart from this, we will publish them in full. 


For more information about what we do with personal data please see our privacy notice. 


Please note, we are using the platform Snap Surveys to gather this information. Any data collected 
by Snap Surveys for ICO is stored on UK servers. You can read their Privacy Policy here. 


Section 1: Your views on the code 


Is the 'About this code' section clearly communicated? 
Q1 © Yes 
No 


If no, then please provide your reasons for this view. 
Qla 


Is the 'Services covered by this code' section clearly communicated? 
Q2 © Yes 
No 


If no, then please provide your reasons for this view. 
Q2a 


Section 2: Your views on the draft standards 


There are 16 draft standards in the code. You can comment on all the drafts 
standards, or focus on a single standard. If you do not want to answer questions on a 
standard please press skip. 


The standards are: 


1) Best interests of the child 

2) Age Appropriate Application 

3) Transparency 

4) Detrimental use of data 

5) Policies and community standards 
6) Default settings 

7) Data minimisation 

8) Data sharing 

9) Geolocation 

10) Parental Controls 

11) Profiling 

12) Nudge techniques 

13) Connected toys and devices 

14) Online tools 

15) Data protection impact assessments 
16) Governance and accountability 


Q3 


Q4 


Q4a 


Best interests of the child: The best interests of the child should be a primary 
consideration when you design and develop online services likely to be accessed 
by a child. 


© I would like to comment on this standard 
Skip 


Have we communicated our expectations for this standard clearly? 
Yes 


© No 


If no, then please give reasons for your answer. 


What is ‘likely to be accessed by a child”? Any child could access any platform unless 
age verified. We request they confirm they are 13 or over just to alert users it’s not 
a child platform. But now you apply obligations for any user under 18. Talk about 
confusing. Navigating this minefield is way too complex. By definition now any 
platform is likely to be accessed by a child unless it’s age rated 18plus! 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 
Q5 Yes 
No 
If yes, then please give reasons for your answer. 


Q5a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q6 Yes 
No 
If yes, then please give reasons for your answer. 
Q6a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q7 Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 
Q7a 


Q8 


Q8a 


Q9 


Q9a 


Q10 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


© Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Startups will need to raise new capital to invest in compliance, that takes a 
minimum of 6 months often longer. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Age-appropriate application: Consider the age range of your audience and 
the needs of children of different ages. Apply the standards in this code to all 
users, unless you have robust age-verification mechanisms to distinguish adults 
from children. 


© I would like to comment on this standard 
Skip 


Have we communicated our expectations for this standard clearly? 


Q11 @ Yes 
No 
If no, then please give reasons for your answer. 
Qila 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q12 Yes 


© No 


If yes, then please give reasons for your answer. 
Qi2a 


Q13 


Qi3a 


Q14 


Q1i4a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


Our Krowd app has been built private by design and within a trustworthy platform 
design objective as a next gen of social platform. We make data minimisation our 
point of innovation, getting down to 6 items of stored/processed potentially personal 
data within our platform (note certain android and iOS services seem to collate a lot 
more and as we find them we seek to remove them but it’s hard) that we 
incrementally consent which makes consent actually work as request for access is at 
point of use and thus purpose is clearly conveyed. With this new legislation we either 
have to 1. Invoke a costly (app is truly free and you are not the product) age 
verification platform, that further requires access to a lot more sensitive personal 
data to process, actually creating more risk of harm to users than our current 
design! Cost alone may force a fundamental rethink back to the idea the user is the 
product if we incur unsustainable costs for the free app. This is fundamentally the 
end of our core brand proposition to compete with twitter etc Or 2. Asssume all 
users might be a child and at every one of the incremental consent points seek 
parental consent....again driving collation of more data, notwithstanding the 
unworkable UX this creates which will block all user adoption. Either that or we go 
back to current norms of one privacy policy no one reads...which we were seeking to 
avoid so we get real consent! As an exemplar of what you are seeking to create, a 
world where personal data is treated with respect and empowered for use by the 
individual, this law does the opposite to us! 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


© Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Our free app which takes little to no data paid for by a few customers purchasing 
SaaS overlays to engage....without taking data...is killed by this law as defined in 
our previous response. You actually require more data collation for compliance than 
we currently collate, this putting individuals at more risk not less, whether child or 
adult. 


Q15 


Q15a 


Q16 


Qi6a 


Q17 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


© Yes 

No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


It requires massive investment as a startup, potentially killing our business entirely. 
This after Home Office OSCT direct investment after winning award to make 
crowded places safer....leading to early customer adoption that was endorsed by A 
home office press release direct from the security minister. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Transparency: The privacy information you provide to users, and other 
published terms, policies and community standards, must be concise, 
prominent and in clear language suited to the age of the child. Provide 
additional specific ‘bite-sized’ explanations about how you use personal data at 
the point that use is activated. 


© I would like to respond to this standard 
Skip 


Have we communicated our expectations for this standard clearly? 
Q18 © Yes 
No 


If no, then please give reasons for your answer. 
Q18a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q19 @ Yes 
No 


If yes, then please give reasons for your answer. 


Q19a Not. Hold specific but the concept of data minimisation we espouse leads to an 


opportunity for incremental contextual consent that ensures truly informed 
consent....the key problem with the legal framework at the moment is the long 
privacy policy no one reads....we avoid that burden and empower users with 
knowledge of what data and what purpose that is so limited they can comprehend. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q20 Yes 
No 


If yes, then please give reasons for your answer. 
Q20a 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q21 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q21a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q22 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q22a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
Q23 Yes 
No 
If yes, then please provide details (including links). 
Q23a 


Detrimental use of data: Do not use children’s personal data in ways that 
have been shown to be detrimental to their wellbeing, or that go against 
industry codes of practice, other regulatory provisions or Government advice. 


I would like to respond to this standard 


© Skip 


Q24 


Have we communicated our expectations for this standard clearly? 
Q25 Yes 
No 


If no, then please give reasons for your answer. 
Q25a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q26 Yes 
No 


If yes, then please give reasons for your answer. 
Q26a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q27 Yes 
No 
If yes, then please give reasons for your answer. 
Q27a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q28 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q28a 
Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 

Q29 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q29a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q30 Yes 
No 
If yes, then please provide details (including links). 
Q30a 


Policies and community standards: Uphold your own published terms, 
policies and community standards (including but not limited to privacy policies, 
age restriction, behaviour rules and content policies). 
© I would like to respond to this standard 

Skip 


Q31 


Have we communicated our expectations for this standard clearly? 
Q32 © Yes 
No 
If no, then please give reasons for your answer. 
Q32a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q33 @ Yes 
No 


If yes, then please give reasons for your answer. 


Q33a Our social platform creates a social platform per venue, we then enable venues to 


manage them, thus curating their social platform to a social context relevant to 
location. The big issue with social platforms today is they are too big to 


manage....we solve this by breaking the internets into manageable intranets where 
local norms can be asserted and managed. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q34 Yes 
No 


If yes, then please give reasons for your answer. 
Q34a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


Q35 Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q35a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q36 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q36a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q37 Yes 
No 
If yes, then please provide details (including links). 
Q37a 


Default settings: Settings must be ‘high privacy’ by default (unless you can 
demonstrate a compelling reason for a different default setting, taking account 
of the best interests of the child). 


Q38 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 


Q39 Yes 
No 
If no, then please give reasons for your answer. 


Q39a 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 
Q40 Yes 
No 
If yes, then please give reasons for your answer. 
Q40a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q41 Yes 
No 


If yes, then please give reasons for your answer. 
Q41a 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q42 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q42a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q43 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q43a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
Q44 Yes 
No 
If yes, then please provide details (including links). 
Q44a 


Data minimisation: Collect and retain only the minimum amount of personal 
data you need to provide the elements of your service in which a child is 
actively and knowingly engaged. Give children separate choices over which 
elements they wish to activate. 
© I would like to respond to this standard 

Skip 


Q45 


Have we communicated our expectations for this standard clearly? 
Q46 @ Yes 
No 


If no, then please give reasons for your answer. 
Q46a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q47 @ Yes 
No 
If yes, then please give reasons for your answer. 


Q47a We make data minimisation our point of innovation. For example although we use 
location services we don’t collect location, instead we collate enough data to collate 
people then connect them, and all data is hashed so they are just comparators so 
even if hacked there is nothing there to see in terms of location data in the free use 
version of the app. Some overlay services offered to venues collate absolute data 
upon request of a specific service which is communicated transparently at point of 
use and covered by an LIA. The initial use case is about keeping crowds safer as 
part of the uk gov Improving Crowd Resilience program. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q48 Yes 


© No 


If yes, then please give reasons for your answer. 


Q48a 
Do you envisage any feasibility challenges to online services delivering this standard? 
Q49 Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 
Q49a 
Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q50 @ Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q50a Yes so we can be sure this focus on location is manageable and acceptable within 
our method of working which is already private by design. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q51 Yes 
No 
If yes, then please provide details (including links). 
Q5ia 
Data sharing: Do not disclose children’s data unless you can demonstrate a 
compelling reason to do so, taking account of the best interests of the child. 
Q52 


I would like to respond to this standard 
Skip 


Have we communicated our expectations for this standard clearly? 
Q53 Yes 
No 
If no, then please give reasons for your answer. 
Q53a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q54 Yes 
No 
If yes, then please give reasons for your answer. 
Q54a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q55 Yes 
No 
If yes, then please give reasons for your answer. 
Q55a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q56 Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q56a 


Q57 


Q57a 


Q58 


Q58a 


Q59 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 


this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Geolocation: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the best 
interests of the child), and provide an obvious sign for children when location 
tracking is active. Options which make a child's location visible to others must 
default back to off at the end of each session. 


© I would like to respond to this standard 
Skip 


Q60 


Q60a 


Q61 


Q6ia 


Q62 


Q62a 


Have we communicated our expectations for this standard clearly? 


© Yes 
No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


© Yes 

No 
If yes, then please give reasons for your answer. 
Potentially. We collate permission for using location services but don’t use absolute 
location at all in the free version of the app. This needs to be understood by the 
ICO. App location permissions now include access to WiFi data that can be used 
benignly as we do to create groups of users based on location without actually 
collating any actual location data. The wording of this law needs to understand this 


nuance or we will be forced to not enable this private by design location oriented 
service. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 
No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q63 Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q63a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q64 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q64a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q65 Yes 


No 
If yes, then please provide details (including links). 


Q65a 


Parental controls: If you provide parental controls give the child age 
appropriate information about this. If your online service allows a parent or 
carer to monitor their child's online activity or track their location, provide an 
obvious sign to the child when they are being monitored. 


I would like to respond to this standard 
Skip 


Q66 


Have we communicated our expectations for this standard clearly? 
Q67 Yes 
No 
If no, then please give reasons for your answer. 


Q67a 
Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 

Q68 Yes 


No 
If yes, then please give reasons for your answer. 
Q68a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q69 Yes 
No 
If yes, then please give reasons for your answer. 
Q69a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q70 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q70a 
Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 

Q71 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q71a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q72 Yes 
No 

If yes, then please provide details (including links). 

Q72a 
Profiling: Switch options which use profiling off by default (unless you can 
demonstrate a compelling reason for profiling, taking account of the best 
interests of the child). Only allow profiling if you have appropriate measures in 
place to protect the child from any harmful effects (in particular, being fed 
content that is detrimental to their health or wellbeing). 

Q73 


© I would like to respond to this standard 
Skip 


Have we communicated our expectations for this standard clearly? 
Q74 Yes 
No 
If no, then please give reasons for your answer. 
Q74a 


Q75 


Q75a 


Q76 


Q76a 


Q77 


Q77a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


© Yes 
No 
If yes, then please give reasons for your answer. 


We don't profile anyone’s personal data, instead ask them to profile themselves and 
give them complete control of that profile, able to delete or modify it at any time. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 


No 
If yes, then please give reasons for your answer. 


Self profiling explicitly opted into gets caught by your wording that assumes all 
profiling is done surreptiously. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q78 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q78a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q79 Yes 


No 
If yes, then please provide details (including links). 


Q79a 


Nudge techniques: Do not use nudge techniques to lead or encourage children 
to provide unnecessary personal data, weaken or turn off privacy protections, 
or extend use. 

Q80 I would like to respond to this standard 


Skip 


Have we communicated our expectations for this standard clearly? 
Q81 Yes 
No 


If no, then please give reasons for your answer. 
Q8ia 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q82 Yes 
No 
If yes, then please give reasons for your answer. 
Q82a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q83 Yes 
No 


If yes, then please give reasons for your answer. 
Q83a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q84 Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 
Q84a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 
Q85 Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q85a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q86 Yes 
No 
If yes, then please provide details (including links). 
Q86a 


Connected toys and devices: If you provide a connected toy or device ensure 
you include effective tools to enable compliance with this code 
Q87 I would like to respond to this standard 


Skip 


Have we communicated our expectations for this standard clearly? 
Q88 Yes 
No 
If no, then please give reasons for your answer. 


Q88a 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 

Q89 Yes 


No 
If yes, then please give reasons for your answer. 
Q89a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q90 Yes 
No 
If yes, then please give reasons for your answer. 
Q90a 
Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q91 Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 
Q91a 
Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q92 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q92a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q93 Yes 
No 
If yes, then please provide details (including links). 
Q93a 


Online tools: Provide prominent and accessible tools to help children exercise 
their data protection rights and report concerns. 


Q94 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q95 Yes 
No 
If no, then please give reasons for your answer. 
Q95a 


Do you have any examples that you think could be used to illustrate the approach 
we are advocating to this standard? 
Q96 Yes 


No 
If yes, then please give reasons for your answer. 
Q96a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q97 Yes 


No 
If yes, then please give reasons for your answer. 
Q97a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q98 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you think 
they could be overcome? 
Q98a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q99 Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what you 
think a reasonable transition period would be and why. 
Q99a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Q100 


Q100a 


Data protection impact assessments: Undertake a DPIA specifically to assess 
and mitigate risks to children who are likely to access your service, taking into 
account differing ages, capacities and development needs. Ensure that your 
DPIA builds in compliance with this code. 
© I would like to respond to this standard 

Skip 


Q101 


Have we communicated our expectations for this standard clearly? 
Q102 Yes 
No 
If no, then please give reasons for your answer. 


Q102 
a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q103 Yes 
No 
If yes, then please give reasons for your answer. 
Q103 
a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q104 @ Yes 
No 
If yes, then please give reasons for your answer. 


You force every platform to assume possible use by a child and thus every platform 
now needs a DPIA which can be costly to a startup, just another barrier to the 
market. Especially when the data you now need for age verification exceeds the 


data collated by the platform in the first place! So most of our dpia will be about that 
issue rather than the platform! 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q105 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q105 
a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q106 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q106 
a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
Q107 Yes 
No 
If yes, then please provide details (including links). 


Q107 
a 


Governance and accountability: Ensure you have policies and procedures in 
place which demonstrate how you comply with data protection obligations, 
including data protection training for all staff involved in the design and 
development of online services likely to be accessed by children. Ensure that 
your policies, procedures and terms of service demonstrate compliance with the 
provisions of this code 


Q108 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q109 Yes 
No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q110 Yes 
No 
If yes, then please give reasons for your answer. 


Q110 
a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Qiii Yes 
No 
If yes, then please give reasons for your answer. 
Qiii 
a 
Do you envisage any feasibility challenges to online services delivering this standard? 
Q112 Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 
Q112 
a 
Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 
Q113 Yes 
No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 
Q113 


a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q114 Yes 
No 
If yes, then please provide details (including links). 
Q114 
a 


Section 3: Your views on the code sections 


Is the 'Enforcement of this code’ section of the code clearly communicated? 
Q115 Yes 


© No 


If no, then please provide your reasons for this view. 
Q115 Too much ambiguity on likely child access. 


a 
Is the 'Glossary' section of the code clearly communicated? 
Q116 @ Yes 
No 
If no, then please provide your reasons for this view. 
Q116 
a 
Are there any key terms missing from the 'Glossary'? 
Q117 Yes 


© No 


If yes, then please provide your reasons for this view. 
Q117 
a 


Is the 'Annex A: Age and developmental stages' section of the code clearly 
communicated? 


Q118 © Yes 
No 
If no, then please provide your reasons for this view. 
Q118 
a 


Is there any information that you think needs to be changed in the Annex A: 
Age and developmental stages' section of the code? 
Q119 @ Yes 
No 
If yes, then please provide your reasons for this view. 
Q119 Adding in ages 13 to 17 as children creates a new class of legal entity previously 


a clarified under GDPR and UK selection. So now all platforms are likely to be accessed 
by a child. 


Do you know of any online resources that could be usefully linked to the 
‘Annex A: Age and developmental stages' section of the code? 


Q120 Yes 

© No 

If yes, then please provide details (including links). 
Q120 
a 


Is the 'Annex B: Lawful basis for processing’ section of the code clearly 
communicated? 


Q121 © Yes 
No 
If no, then please provide your reasons for this view. 
Q121 
a 


Is the 'Annex C: Data Protection Impact Assessment' section of the code 
clearly communicated? 
Q122 @ Yes 
No 
If no, then please provide your reasons for this view. 


Q122 
a 


Do you think any issues raised by the code would benefit from further (post 
publication) work, research or innovation? 


Q123 Yes 

© No 

If yes, then please provide your reasons for this view. 
Q123 
a 


Section 4: About you 


Are you answering as: 
Q124 A body representing the views or interests of children 

A body representing the views or interests of parents 
A child development expert 
An academic 
An individual acting in another professional capacity 

© A provider of an ISS likely to be accessed by children 
A trade association representing ISS providers 


An individual acting in a private capacity (e.g. someone providing their views as a 
member of the public of the public or a parent)? 


An ICO employee 
Other 
Please specify: 
Q124 
a 


Please specify: 
Q124 
b 


Please state your name or if you're answering on behalf of an organisation, 
your organisation's name. 


Q125 Krowdthink Ltd 


Thank you for responding to this consultation 
We value your input. 


